ItemDex/RB:107: Difference between revisions

Jump to navigation Jump to search
Content added Content deleted
Line 18: Line 18:
==Arbitrary code execution methods==
==Arbitrary code execution methods==
===Hall of Fame entry bootstrap===
===Hall of Fame entry bootstrap===
If the player views a Level 211 [[GlitchDex/RB:195|h POKé (0xC3)]] (getting one at this high of a level is possible with [[Rival LOL glitch]]) in the Hall of Fame, it will write C3 18 D3 to (jp D318) at CD3D, so using the item will execute Pokédex flags (from seen 113-seen 152, and then the player's inventory data starting with the number of items, then item/quantity pairs). Certain combinations of Pokédex flags will make this region unsafe, so to prevent issues it's a good idea that Pokédex entries 113-152 are not seen at all.
If the player views a Level 211 [[GlitchDex/RB:195|h POKé (0xC3)]] (getting one at this high of a level is possible with [[Rival LOL glitch]]) in the Hall of Fame, it will write C3 18 D3 to (jp D318) at CD3D, so using the item will execute Pokédex flags (from seen 113-seen 152, and then the player's inventory data starting with the number of items, then item/quantity pairs). Certain combinations of Pokédex flags will break the arbitrary code execution in items, so to prevent issues it's a good idea that Pokédex entries 113-152 are not seen at all.


Using another level for the h POKé is also an option, such as 219 to execute DB18 (current PC box Pokémon 5 PP of Move 3). It may also be possible to use a different glitch Pokémon representing a conditional variation of the jp opcode (C2 (jp nz), CA (jp z), D2 (jp nc), or DA (jp c)) depending on the state of CD38-CD3C (all flags are reset by default, in which case CA and DA wouldn't work).
Using another level for the h POKé is also an option, such as 219 to execute DB18 (current PC box Pokémon 5 PP of Move 3). It may also be possible to use a different glitch Pokémon representing a conditional variation of the jp opcode (C2 (jp nz), CA (jp z), D2 (jp nc), or DA (jp c)) depending on the state of CD38-CD3C (all flags are reset by default, in which case CA and DA wouldn't work).